CVE-2026-73800 Gitea CVE debrief

Who should care

Gitea administrators, developers using Gitea for their projects, and security teams responsible for monitoring and mitigating vulnerabilities in CI/CD pipelines should assess exposure and apply necessary patches or mitigations.

Why it matters

This vulnerability in Gitea's reusable workflow feature allows a fork author to potentially access repository and organization secrets by modifying a referenced workflow. Defenders should prioritize verifying exposure, applying patches, and restricting workflow permissions to minimize risk.

• Defenders must verify Gitea deployments for exposure to this vulnerability, especially those using reusable workflows with pull_request_target events.
• Successful exploitation could lead to unauthorized access to repository and organization secrets.
• Applying patches or mitigations, such as upgrading to Gitea version 1.27.2 or later, is crucial to prevent potential secret exposure.
• Further investigation is required to determine the full scope of affected systems and potential business impact.

Technical summary

The Gitea vulnerability involves resolving local reusable workflow files from a fork's head commit during a pull_request_target event. This allows a fork author to modify the referenced reusable workflow, enabling attacker-controlled code execution with access to repository and organization secrets. A base workflow must call a local reusable workflow and bypass the intended separation between trusted base code and untrusted fork code. Defenders should assess exposure in Gitea deployments using reusable workflows, especially those with pull_request_target events, and apply patches or mitigations as available, such as upgrading to Gitea version 1.27.2 or later.

Defensive priority

Defenders should prioritize verifying exposure in Gitea deployments using reusable workflows, especially those with pull_request_target events, and apply patches or mitigations as available.

Recommended defensive actions

• Verify Gitea deployments for exposure to CVE-2026-73800, especially those using reusable workflows with pull_request_target events.
• Apply patches or mitigations as available, such as upgrading to Gitea version 1.27.2 or later.
• Review and restrict workflow permissions to minimize exposure to untrusted fork code.
• Monitor Gitea deployments for suspicious activity related to reusable workflows.
• Perform an inventory of assets using Gitea to prioritize patching efforts.
• Establish a change window for applying patches or mitigations to exposed systems.
• Track the status of patching and mitigation efforts for CVE-2026-73800.

Evidence notes

The CVE record and source item provide details on the vulnerability, but limited information is available on exploitation or impact. Official sources, including the Gitea security advisory and release notes, offer additional context.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.